HSB 154

This bill relates to the use of certain technology. The bill provides that a record, signature, or contract shall not be denied legal effect because it is created or stored by means of distributed ledger technology or a smart contract, as those terms are defined in the bill. The bill provides that the ownership of the secure information remains with the original owner of the information, not the distributed ledger technology owner, unless specifically provided otherwise. The bill creates affirmative defenses for entities using cybersecurity programs. The bill provides that a covered entity seeking an affirmative defense must use a cybersecurity program for the protection of personal information and restricted information and the cybersecurity program must reasonably conform to an industry-recognized cybersecurity framework. A cybersecurity program must continually evaluate and mitigate reasonably anticipated threats, periodically evaluate the maximum probable loss attainable from a data breach, and communicate to affected parties the risk posed and actions the affected parties could take to reduce damages if a data breach has occurred. _____ cybersecurity program is appropriate if the cost to operate the program is no less than the covered entity’s maximum probable loss value. A covered entity that satisfies these requirements and that reasonably conforms to an industry-recognized cybersecurity framework is entitled to an affirmative defense to a tort claim that alleges that the failure to implement reasonable information security controls resulted in a data breach concerning personal information or restricted information. The bill details industry-recognized cybersecurity frameworks that the covered entity may follow and reasonably comply with in order to qualify for the affirmative defense. The bill does not provide a private right of action, including a class action.